WordPress 7.1.4: the update-window vulnerability and what to do

What happened

• The release: WordPress 7.1.4 came out on 28 October 2026 with fixes for 22 security flaws, and the same fix was released for every branch back to 4.7.
• The serious one: CVE-2026-119977, rated 8.1 out of 10, in WordPress 4.7 to 7.1.3. When WordPress installs a full core update, it unpacks the new files into a predictable folder inside wp-content/upgrade, and that copy includes the WordPress installer. On many servers that folder can be opened from the web, so an attacker who requests the installer at exactly the right moment can take it over and run code on the server. No login is needed.
• The catch for attackers: the window normally lasts only a few seconds, until WordPress cleans up. So they keep asking, over and over, hoping to hit it.
• Attacks: Wordfence saw the first attempt nine minutes after its firewall rule went live, more than 18,500 attempts in the first 21 hours and nearly 63,000 in a day. Two sources polled small groups of sites for about 14.5 hours, trying to catch an update in progress. No site is publicly confirmed hacked this way so far.
• The fix: 7.1.4 uses a random folder name, adds a guard file and stops unsafe use of the staged settings.

Is my site affected?

Your site needs one of these versions, or newer in the same branch:

• 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18
• 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34, 4.7.39

To check, open Dashboard → Updates, or run wp core version over SSH. The free Moatline Malware Scanner also warns you on its Overview when your WordPress version is on this list or another one under attack, and checks twice a day.

Update safely

1. Back up files and database first.
2. Update from Dashboard → Updates, or with wp core update.
3. If the update fails halfway and the site shows “Briefly unavailable for scheduled maintenance”, delete the .maintenance file in the WordPress folder, then reinstall WordPress with wp core download --skip-content --force. Old hosting tools left in wp-admin or wp-includes after a move between hosts are a common cause.
4. Check the result with wp core verify-checksums. A forced reinstall overwrites WordPress files but never deletes old ones, so remove anything it lists as “File should not exist”.

Block web access to the update folder

WordPress writes updates into wp-content/upgrade on the server itself and never needs to open that folder from the web. Blocking it closes this bug, and any similar one in a plugin or theme update, without affecting updates.

• Apache or LiteSpeed: add this to the .htaccess file in your WordPress folder:

  <IfModule mod_alias.c>
  RedirectMatch 403 ^/wp-content/upgrade(?:/|$)
  </IfModule>

• Nginx: add location ^~ /wp-content/upgrade/ { deny all; } to the site’s server block, or ask your host to.
• Managed hosts (Kinsta, WP Engine, Flywheel and similar): ask support to block web access to /wp-content/upgrade/.

In the free Moatline Malware Scanner 1.4.0, this is one click: Protect → Files & code → Block web access to the update folder, and the Security Advisor recommends it on Apache and LiteSpeed servers. It can be undone just as easily.

Check nothing got in

If your site ran an older version during a core update, take five minutes to check:

1. Look inside wp-content/upgrade. Between updates it should be empty or hold only temporary folders. A PHP file there you can’t explain is a red flag.
2. Check your access logs (your host’s control panel usually has them) for requests to wp-content/upgrade/, especially setup-config.php, around the time WordPress updated.
3. Check for administrators and plugins you don’t recognise, including admins hidden from the Users screen.
4. Run a full scan. Moatline checks core files against WordPress.org, plugins, uploads, must-use plugins and the database. See how to scan WordPress for malware.

The other 21 fixes

Most need an Author, Contributor or Editor account, or a logged-in user to view a booby-trapped page, so they matter most on sites with several writers:

• Stored cross-site scripting in block markup, the Categories block, pagination and navigation labels, the Customizer, personal-data erasure requests, crafted usernames, and the Image and Playlist blocks.
• Several Interactivity API issues, including a denial-of-service bug.
• A leak of unpublished Customizer changes to logged-out visitors.
• A permissions gap in the Notes REST API for some custom roles.
• Updated root certificates after a certificate authority was revoked.

Sources: Wordfence and The Hacker News.

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

More guides

• WordPress files deleted: how we rebuilt a site from its database
• TRUST#GRAFT: a fake Cloudflare check that installs a backdoor through your own browser
• The WordPress.org notice about Essential Plugin: how to clean what the update left behind
• PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed versions and what to do now
• Bricksforge vulnerability exploited: how to check your site and clean it
• Rank Math PRO 3.0.123 malware: who is affected and how to clean up

All guides →